A live exploit targeting StablR’s issuer has driven its Euro and USD-pegged stablecoins away from parity, with roughly $2.8 million extracted so far, according to blockchain security firm Blockaid.

Blockaid said the incident appears to stem from a compromised private key within a 1-of-3 minting multisignature account. The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, triggering the depeg.

“This is not a smart contract bug — it’s a key management and governance failure,” Blockaid said.

The attacker swapped the minted tokens for around 1,115 ETH (about $2.8 million) on decentralized exchanges, a move constrained by thin liquidity in the market for these assets.

Blockaid’s assessment underscores a governance weakness rather than a flaw in the token contracts themselves.

May has seen a string of crypto and DeFi exploits, with DeFiLlama tallying more than a dozen major incidents this month. Notable cases include THORChain, Verus Bridge, Echo Protocol and Polymarket.

StablR depeg details and price signals

EURR, StablR’s euro-denominated stablecoin with a market capitalization around $14 million, has lost about 23% of its value, trading around $0.88, according to CoinGecko. USDR, a dollar-pegged stablecoin with roughly $11 million in market cap, has slumped about 30% to around $0.70 in the ongoing incident.

StablR emphasizes that its euro and USD stablecoins are regulated, collateralized assets with reserves held in segregated accounts at top-tier institutions, and they are available on Ethereum and Solana. Tether invested in StablR in December 2024, signaling institutional interest in Europe-focused stablecoins. There have been no updates on StablR’s X feed at press time.

PeckShield flagged the EURR depeg in its alerts, underscoring the ongoing price dislocations in these assets.

Broader DeFi risk landscape this May

As this incident unfolds, the wider DeFi space continues to grapple with security challenges tied to private-key and governance weaknesses. In the past two months, Volo Vault, Wasabi Perps, Echo Protocol and Polymarket have all suffered exploits tied to private or admin-key access. Separately, Map Protocol, a cross-chain bridge linked to Bitcoin-anchored assets, experienced a smart-contract bug on May 21 that minted a quadrillion MAPO tokens, highlighting how fast-moving cross-chain projects remain vulnerable to unexpected token minting events.

What this means for investors and builders

For investors and users, the StablR incident serves as a reminder that peg stability in regulated, collateralized stablecoins hinges not just on the token contracts but on governance and key-management practices. A weak multisignature threshold — such as 1-of-3 — can leave an issuer exposed to takeover if even a single owner is compromised. The episode also tests the resilience of reserve-backed models when liquidity is thin, complicating recovery efforts after a depeg.

From a market-structure perspective, the event underscores the importance of clear proof-of-reserves, robust custody for private keys, and rigorous governance reviews, particularly for issuers with institutional backers—such as Tether’s stake in StablR. It also raises questions about the pace and transparency of post-incident recoveries, and how on-chain data will reflect liquidity recovery and peg restoration.

Looking ahead, readers should monitor StablR’s communications and any forthcoming audits or contingency plans, as well as how regulators respond to stablecoin governance incidents and asset-liability disclosures. The next few weeks will be telling for the credibility of regulated collateralized stablecoins amid a broad pattern of DeFi breaches this year.

Readers should watch for StablR’s official updates and any audits or contingency measures, as peg stability and governance resilience remain under close scrutiny in a rapidly evolving DeFi environment.

An ongoing exploit is impacting StablR, resulting in the depeg of its Euro and USD stablecoins, while a compromised private key has been blamed, adding to a lengthening list of hacks and exploits this month.

Blockchain security firm Blockaid reported on Sunday that its exploit detection system has identified an ongoing exploit on the StablR issuer, with around $2.8 million extracted so far.

The suspected cause is a private key compromise of one owner in the minting multisignature account, which used a weak 1-of-3 threshold, stated Blockaid. 

The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, causing the stablecoins to depeg. 

The attacker then swapped the minted tokens worth around $10.4 million on decentralized exchanges for just 1,115 ETH or around $2.8 million due to thin liquidity. 

“This is not a smart contract bug — it’s a key management and governance failure,” said Blockaid. 

May has been a bad month for crypto and DeFi exploits with over a dozen major incidents so far, according to DeFiLlama. Some of the larger ones included THORChain, Verus Bridge, Echo Protocol and Polymarket. 

StablR euro and dollar stablecoins depeg 

StablR’s euro stablecoin, EURR, which has a $14 million market capitalization, lost 23% of its value, which depegged the asset from its $1.15 peg to $0.88 in EUR/USD markets, according to CoinGecko.

Meanwhile, StablR’s USDR dollar stablecoin, with an $11 million market capitalization, tanked 30% to $0.70 in the ongoing incident on Sunday morning.

Related: Map Protocol token plummets 96% after a quadrillion token mint exploit

StablR issues regulated collateralized stablecoins pegged to the Euro and USD, with reserves held in segregated accounts at top-tier institutions. They emphasize regulatory compliance, transparency via proof-of-reserves and availability on Ethereum and Solana.

The world’s largest stablecoin issuer, Tether, invested in StablR in December 2024. 

There were no updates on the StablR X feed at the time of writing. 

EURR depegs 23%. Source: Peckshield 

DeFi exploits continue to mount 

Compromised private keys are becoming a common attack vector, with several DeFi protocols being exploited as a result of poor management recently. 

Volo Vault, Wasabi Perps, Echo Bridge and Polymarket were all hit with private or admin key exploits over the past two months. 

Meanwhile, the Bitcoin cross-chain bridge Map Protocol was exploited by a smart contract bug on Wednesday, May 21, when an attacker minted a quadrillion MAPO tokens. 

Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks

StablR’s euro and US dollar stablecoins have depegged as an ongoing exploit targets the project’s minting multisignature account. Blockchain security firm Blockaid reports that its monitoring detected roughly $2.8 million extracted so far, with the attack traced to a compromised private key in a 1-of-3 minting threshold. The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, triggering the depegging. The newly minted tokens were swapped on decentralized exchanges for about 1,115 ETH—roughly $2.8 million—due to thin liquidity. Blockaid characterized the incident as a governance and key-management failure rather than a flaw in a smart contract.

The disruption comes amid a troubling month for crypto and DeFi security, with DeFiLlama tallying more than a dozen major exploits so far in May. Notable incidents have included attacks on THORChain, the Verus Bridge, Echo Protocol, and Polymarket, underscoring the breadth of attack vectors facing the sector this year.

Key takeaways

• Attack traced to a compromised private key in StablR’s minting multisignature account, with a weak 1-of-3 threshold enabling the breach.
• EURR depegged to about $0.88 and USDR fell to about $0.70, reflecting the immediate impact of the minting attack on liquidity and confidence.
• Approximately $2.8 million has been extracted so far, with 8.35 million USDR and 4.5 million EURR minted and swapped for ETH due to liquidity constraints.
• Blockaid stresses that the incident is fundamentally a governance and key-management failure, not an obvious smart-contract bug.
• The broader DeFi landscape in May includes numerous high-profile exploits tied to private-key and governance weaknesses, reinforcing a pattern that investors and builders should monitor closely.

How the breach unfolded and what it means for StablR

StablR operates as a regulated, collateralized stablecoin issuer offering euro- and dollar-pegged tokens. The project emphasizes reserves held in segregated accounts at established institutions, along with proof-of-reserves and cross-chain availability on Ethereum and Solana. In December 2024, StablR also drew attention when Tether invested in the project to promote stablecoin adoption in Europe. The current incident, however, highlights a stark contrast between a stated governance framework and the practical realities of key-management in multisignature setups.

According to Blockaid, the perpetrator exploited a weak key-management arrangement within the minting multsig, then assumed control of the three-key setup by replacing the other owners. The attacker minted 8.35 million USDR and 4.5 million EURR, effectively depegging the two tokens from their $1 parity bands. The minted tokens were subsequently liquidated on decentralized exchanges for approximately 1,115 ETH, translating to around $2.8 million in proceeds given current liquidity conditions. Blockaid summarized the situation by stating that this is not a smart contract bug; it is a failure of key management and governance structures that should have prevented such a takeover.

StablR’s euro stablecoin, EURR, has a market capitalization near $14 million, while its US dollar token, USDR, sits around $11 million. In the present episode, CoinGecko-tracking data shows EURR slipping from parity toward the mid-$0.80s range, and USDR hovering around the $0.70 level as the incident unfolds. The depegging has raised questions about liquidity depth, reserve sufficiency, and the speed with which stablecoins can respond to coordinated governance- or key-management failures.

There is no sense that the underlying collateral model or reserve strategy has collapsed; rather, the attack underscores the practical risk of relying on multisignature governance without robust key-management controls, hardware security modules, and regular key-rotation and access reviews. StablR notes that reserves are held in segregated accounts at top-tier institutions and that it aims to maintain transparency via proof-of-reserves and cross-chain availability. The incident has also prompted scrutiny of the project’s governance processes and incident-response posture as it works to restore confidence among users and counterparties.

For investors and users relying on stablecoins, the episode serves as a reminder of the hidden frictions in governance-heavy models. While the project’s backing by a major stablecoin issuer—Tether—adds a layer of credibility, the immediate depeg demonstrates how quickly trust can erode when safeguarding critical private keys and governance rights falter. For participants, the questions are: what changes will StablR implement to harden its multisignature framework, how quickly will reserves be audited and disclosed, and what protections will be offered to users hurt by the depeg?

Broader security landscape: private-key exploits persist in DeFi

The StablR incident sits within a wider tapestry of security breaches this year that center on compromised keys and governance weaknesses. A sequence of recent exploits—Volo Vault, Wasabi Perps, Echo Protocol, and Polymarket—have all involved some manipulation of admin or private keys. Analysts warn that as DeFi ramps up, so do the attack surfaces tied to governance and access management. In parallel, Map Protocol—an Atlantis-style cross-chain map project—was breached when a smart contract vulnerability allowed an attacker to mint a quadrillion MAPO tokens, illustrating a spectrum of technical and governance flaws across ecosystems.

These events collectively highlight a recurring tension in DeFi: rapid innovation and high open access can outpace the development of secure, scalable governance and key-management practices. Industry observers argue that improving multi-party computation, hardware-backed key storage, formalized incident-response playbooks, and enhanced rotation and revocation protocols will be essential as protocols grow larger and more interconnected.

Notable coverage and updates from the security and analytics community, including PeckShield’s alerts and DeFi-focused trackers, continue to document the evolving risk environment. As the market digests ongoing fallout, users will be watching for tangible remedies from projects like StablR—clarified governance changes, enhanced key-management controls, and transparent post-incident disclosures that can help stabilize confidence and liquidity in the face of depeg events.

In this climate, the market remains vigilant for how quickly teams can respond to breaches, how robust their reserve disclosures remain, and what steps are taken to prevent recurrence. With May’s incidents accumulating, the sector could see accelerated adoption of best practices around governance hygiene, key security, and incident preparedness—outcomes that could ultimately contribute to a more resilient stablecoin ecosystem.

There were no updates on the StablR X feed at the time of writing, leaving stakeholders awaiting formal post-incident disclosures and the path forward for recovery. For those tracking the evolving DeFi security landscape, the StablR episode is a concrete reminder that governance design and key-management protocols are no less critical than code quality when it comes to protecting user funds.

As the story develops, readers should watch for StablR’s official incident report, any changes to its multisignature configuration, and forthcoming audits or proofs of reserves that could help restore trust. The broader question remains: will the industry tighten the screws on key management fast enough to prevent similar breaches from repeating across the expanding DeFi frontier?

Crypto markets regained momentum after President Donald Trump signaled progress toward a peace agreement with Iran, lifting risk appetite across digital assets. The broader crypto market cap was estimated to rebound by roughly $75 billion as investors priced in the prospect of de-escalation in the region.

Trump announced on Truth Social that a deal is “largely negotiated” among the United States, Iran, and several Middle Eastern partners, listing Saudi Arabia, the United Arab Emirates, Qatar, Pakistan, Turkey, Egypt, Jordan and Bahrain among those involved. He said the agreement remains subject to finalization, and that a crucial element of the plan is the reopening of the Strait of Hormuz. The Strait’s status has historically influenced global energy prices and broader risk sentiment, including appetite for high-risk assets such as crypto.

“Final aspects and details of the deal are currently being discussed and will be announced shortly. In addition to many other elements of the agreement, the Strait of Hormuz will be opened.”

Three months of war takes its toll

The timing comes as a fragile ceasefire that began in early April has struggled to mature into a durable political accord, with several attempts at a broader settlement failing to yield a lasting outcome. The ongoing diplomacy underscores how geopolitics continues to shape markets that are often highly sensitive to headlines around war, sanctions and energy flows.

During a visit to India, U.S. Secretary of State Marco Rubio reiterated the administration’s position: Iran must not acquire a nuclear weapon, the Straits must remain open without tolls, and Iran should turn over its enriched uranium. His remarks highlight how the geopolitical landscape remains a central driver for risk assets, including crypto markets, even as talks show tentative progress.

On the energy front, crude prices moved lower on renewed hopes for de-escalation. West Texas Intermediate traded near $96 per barrel, with Brent around $103. While these levels are down from earlier spikes, they remain markedly elevated versus pre-conflict benchmarks—roughly 55% higher—maintaining a backdrop of continued pressure on the cost of living and investment returns across asset classes.

Crypto markets react positively

Bitcoin’s price action captured the headlines in the immediate aftermath of the announcement. On Coinbase, BTC slipped to a five-week low near $74,250, according to TradingView data. The price subsequently rebounded to test the 50-day exponential moving average around $77,000 in early trading on Sunday before easing to about $76,800 by the time of publication.

Despite the bounce, bitcoin remains well off its October peak, trading roughly 39% lower. Market participants noted that the failure to breach resistance near $82,000 in recent sessions has kept upside momentum in check, reinforcing a broader narrative of a cautious risk environment for crypto as macro headlines continue to drive sentiment.

Looking beyond Bitcoin, analysts stressed that the immediate reaction to geopolitical headlines can be choppy and context-dependent. While the prospect of a durable peace framework could reduce tail risk for risk assets, any ensuing sanctions, policy shifts, or delays in implementation could reintroduce volatility. The current dynamic underscores how crypto markets remain tethered to macro catalysts even as they experiment with new forms of demand—from savings, cross-border payments, or hedges against traditional financial systems.

What’s next for investors?

As the diplomacy progresses, market watchers will be focused on concrete milestones: the publication of final terms, a clear implementation timeline, and any policy actions that might affect energy markets or sanctions posture. The immediate market reaction has been cautiously optimistic, but the longer-term trajectory for crypto will hinge on the durability of the peace framework and its ripple effects on global energy prices and financial conditions.

For traders and builders in the crypto space, the key questions are whether de-escalation translates into lower macro-generated volatility and whether a steadier energy backdrop supports a more favorable risk-on stance. Investors should stay attentive to official statements and to any shifts in regulatory signals that could alter the balance of risk and opportunity across digital assets.

As the week unfolds, readers should watch for the next round of official communiqués on the peace process, the full terms of any agreement, and how those terms interact with ongoing energy-market dynamics. The coming days will be pivotal in determining whether the current relief rally can sustain momentum or give way to renewed volatility should negotiations stall or face setbacks.

France is grappling with a troubling rise in wrench attacks—violent robberies aimed at crypto holders to steal digital assets. Bitcoin journalist Joe Nakamoto estimates that roughly 70% of these incidents occur in France, a figure he links to the country’s centralized data practices and the exposure of personal information in data breaches.

According to Nakamoto, 41 crypto-related kidnappings have been recorded in France so far in 2026, equating to about one attack every two and a half days. The surge, he argues, is fueled by compromised Know-Your-Customer data stored on centralized servers, exposing home addresses and other personally identifiable information that attackers can weaponize against individuals holding crypto.

The ledger of data abuses in the crypto ecosystem further underscores the vulnerability. Nakamoto notes the 2020 Ledger data breach, which exposed the identities, home addresses and emails of more than 270,000 customers worldwide, as a watershed moment in the risk landscape for holders. In a candid appraisal, Jameson Lopp, CEO of Casa, described France as “the canary in the coal mine,” suggesting that financial regulations surrounding data and privacy can unintentionally magnify harms to bitcoin holders.

France is the canary in the coal mine, demonstrating how financial regulations create a surveillance apparatus that causes direct harm to bitcoin holders.

As the crypto community weighs the implications of these events, opposition to broad data collection and centralized storage of user information has intensified. The wrench-attack phenomenon continues to unfold even as authorities pursue individuals involved in these crimes and as calls for heightened security measures by custodians and the broader industry grow louder.

Key takeaways

• About 70% of wrench attacks are reported to occur in France, a trend linked to centralized KYC data practices and subsequent data breaches.
• In 2026, Nakamoto estimates 41 crypto-related kidnappings in France, roughly one attack every 2.5 days.
• The Ledger data breach in 2020 exposed the identities, home addresses and emails of more than 270,000 customers, highlighting the risks of centralized crypto data stores.
• Industry voices stress practical safeguards for holders, including custody features to verify active attacks, asset freezing capabilities, and strategic use of decoy wallets.
• France reports ongoing enforcement actions, with at least 88 individuals arrested in connection with wrench attacks, signaling continued legal pursuit of perpetrators.

Wrench attacks, data exposure, and what it means for holders

The attacks described by Nakamoto are typically coordinated by criminals operating from abroad, who recruit local associates in France to execute physical raids on crypto owners. This pattern complicates policing and raises the stakes for individual security practices. In response, custodial and key-management providers are increasingly advocating layered defense mechanisms that can be activated in real time when a crisis is detected.

Among the recommended measures is the use of custody services that incorporate a pre-agreed security word or phrase. Such a credential can alert a custodian or asset manager that an attack is underway, enabling rapid asset freezes to prevent unauthorized access and, when appropriate, the timely involvement of law enforcement. The approach aims to curb the immediate theft risk while preserving the possibility of recovering assets through official channels.

Experts also emphasize practical risk-reduction techniques, including maintaining a “decoy” wallet with a small balance that can be handed over if confronted by attackers, thereby reducing the likelihood of a larger loss from a direct confrontation. The broader guidance urges holders to minimize public visibility of their holdings—avoiding overt disclosures online that could flag them as targets—and to coordinate with trusted security partners to establish incident-response playbooks.

For researchers and practitioners tracking these incidents, a community-maintained resource has emerged to catalog known wrench attacks and support risk assessment efforts. The repository at jlopp’s GitHub page documents cases and helps inform safer practices across the ecosystem: GitHub.

Public safety and regulatory responses continue to unfold in France. Vanessa Perrée, the national prosecutor for organized crime, has indicated that at least 88 individuals have been arrested in connection with crypto wrench attacks. The figures underscore a sustained law-enforcement focus on the intersection of physical crime and digital asset ownership, as authorities seek to deter attackers and reassure the crypto community.

Industry observers argue that France’s experience highlights a broader tension in crypto security: the balance between regulatory data requirements and the protection of individual privacy. The push for more stringent data controls and tighter security standards for custodians could help blunt the ability of criminals to identify and premeditate attacks, though critics contend that such measures must not come at the expense of legitimate financial privacy and innovation.

Looking ahead, investors, users and builders will want to monitor both policy developments and practical security enhancements. If the data-privacy debate tilts toward greater protection, we could see a reduction in targeted wrench attacks alongside improved incident-response capabilities from custodians. If, however, data vulnerabilities persist or regulatory regimes inadvertently widen surveillance reach, the risk profile for crypto ownership could remain elevated, especially in jurisdictions with dense central-data ecosystems.

Readers should keep an eye on how custodians evolve their safety features, how law enforcement collaborations evolve, and whether new regulatory frameworks emerge to strike a more robust balance between privacy and security in crypto ownership. The evolving dynamics will shape risk management strategies for individuals and institutions alike in the months ahead.